Skip to main content

cryptoscan

The cryptoscan tool is a cryptographic-discovery scanner for automated security workflows within Canva. It inventories more than 90 cryptographic patterns across source code — algorithms, key sizes, TLS settings, and library imports — and assesses each finding for post-quantum cryptography (PQC) migration readiness. Part of the QRAMM toolkit by CSNP, it scans the contents of remote Git repositories rather than live network endpoints.

Ideal Use Cases & Fit​

cryptoscan is ideal for scenarios that require visibility into the cryptography embedded in a codebase and its exposure to future quantum threats. It excels in contexts such as:

  • Post-quantum readiness audits to identify quantum-vulnerable algorithms (e.g. RSA, ECC) and produce migration-readiness scores across repositories.
  • Cryptographic inventory to build a bill of materials of algorithms, key sizes, and library usage for compliance efforts.
  • Detecting weak or deprecated cryptography such as broken hashes or insecure key sizes in application source.
  • Batch assessment of many repositories in a single run, producing machine-readable results for downstream triage and reporting.

It is not suitable for assessing live TLS endpoints or network services; it analyzes source code obtained from Git repositories only.

Value in Workflows​

In security workflows, cryptoscan adds value at the assessment and inventory stages by surfacing both immediate cryptographic weaknesses and long-term quantum risk directly from source code. Its severity classification, quantum risk levels, and migration-readiness scoring help teams prioritize remediation, while its structured JSON output feeds naturally into reporting, compliance tracking, and PQC migration planning further along the workflow.

Input Data​

The tool expects a newline-separated list of remote Git repository URLs as input. This input is required and specifies the repositories to scan; each is cloned and analyzed in turn. Blank lines and lines beginning with # are ignored. Local filesystem paths are not supported.

Example:

https://github.com/example-org/service-a.git
https://github.com/example-org/service-b.git

Output Data​

Results are emitted as JSONL — one compact JSON object per repository — capturing the individual findings, a summary broken down by severity, category, and quantum risk, a migration-readiness score, and scan metadata. Each line is annotated with the scanned repository URL for traceability. If a repository cannot be scanned (for example, a clone failure), that line records an error instead, and the remaining repositories are still processed.

Configuration​

  • min-severity: Minimum severity to report (info, low, medium, high, critical). Defaults to info.
  • include: Comma-separated file glob patterns to include (e.g. *.go,*.py,*.java).
  • exclude: Comma-separated file glob patterns to exclude (e.g. vendor/*,test/*).
  • max-depth: Maximum directory depth to scan (0 = unlimited). Defaults to 5.
  • group-by: Group findings by file, severity, category, or quantum.
  • ignore: Comma-separated pattern IDs to suppress, with wildcard support (e.g. RSA-001,CERT-*).
  • ignore-category: Comma-separated finding categories to suppress (e.g. Certificate,Library Import).
  • fail-on: Report a non-zero status per repository when findings at or above this severity are found; does not affect the JSON written to output. Updated: 2026-07-06